CVE-2025-38184 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
A local attacker can cause a kernel crash via null pointer dereference in TIPC UDP bearer handling when specific netlink commands are issued.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38184?
CVE-2025-38184 is a high-severity vulnerability in Debian Debian Linux, published on 4 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun
tipc: Started in network mode tipc: Node identity 8af312d38a21, cluster identity 4711 tipc: Enabled bearer <eth:syz_tun>, priority 1 Oops: general protection fault KASAN: null-ptr-deref in range CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT Hardware name: QEMU Ubuntu 24.04 PC RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0
the ub was in fact a struct dev.
when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or other media when other thread changes it.
fix this by checking media_id.
Weakness: CWE-476
Which versions are affected by CVE-2025-38184?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38184?
Apply the vendor's patch.
Is CVE-2025-38184 being exploited?
There is no known exploitation of CVE-2025-38184 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-64785, BELL-CVE-2025-38184, DEBIAN-CVE-2025-38184, GHSA-jhfq-cfj3-rm7v, ROOT-OS-DEBIAN-11-CVE-2025-38184, ROOT-OS-DEBIAN-12-CVE-2025-38184 and 3 more.